Vulnerability details

CVE-2026-59205

python-pillow Pillow

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

CVSS 3.1

7.5High

Official description

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
python-pillow	Pillow	< 12.3.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/python-pillow/Pillow/pull/9715 x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/12.3.0 x_refsource_MISC
https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-14
Last updated: 2026-07-14
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.38%

Probability of exploitation in 30 days

32.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-787
Out-of-bounds Write